Threat reportVulnerabilityTL-2026-2658
Multiple PHP Vulnerabilities Enable Denial of Service, TLS Verification Bypass, and Credential Leakage (CVE-2026-91765, CVE-2026-91768, CVE-2026-6103 and 8 Others) — GovCERT.HK A26-09-40
GovCERT.HK Security Alert A26-09-40 (25 Sep 2026) covers 11 CVEs fixed in PHP 8.5.11, 8.4.26, 8.3.35, and 8.2.34, spanning the SOAP, OpenSSL, PHP-FPM, Phar, Standard, and MySQLnd components. Impacts include unauthenticated remote denial of service via unbounded XML recursion in SoapServer, an IPv6 FastCGI ACL bypass, a TLS certificate-verification bypass, and cross-origin credential leakage on HTTP redirects.
Key facts
Detection coverage
As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2658 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: PHP SoapServer Oversized/Nested XML POST — Unbounded Recursion DoS (CVE-2026-91765)
Detects unauthenticated POST requests to SOAP/WSDL endpoints carrying an oversized or deeply-nested XML body, consistent with the cleanup_xml_node() unbounded-recursion flaw in PHP's SOAP extension (CVE-2026-91765) that lets an attacker exhaust the call stack and crash the SoapServer worker process. Also flags WSDL-discovery probing that typically precedes exploitation.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1190, T1499.004, T1595.002
- Data sources: web_access_logs (apache/nginx access_combined), iis_w3c_logs, php_fpm_error_log
- Severity: high
- Confidence: medium
Splunk SPL
index=web sourcetype=access_combined OR sourcetype=nginx:plus:kv:access
| eval body_len=coalesce(bytes_in, cs_bytes, 0)
| regex uri_path="(?i)(soap|\?wsdl|/wsdl)"
| rex field=_raw "(?<nest_run>(<[A-Za-z0-9_:]+>){50,})"
| eval oversized=if(method="POST" AND body_len>200000, 1, 0)
| eval deeply_nested=if(isnotnull(nest_run), 1, 0)
| where oversized=1 OR deeply_nested=1
| stats count as request_count, min(_time) as first_seen, max(_time) as last_seen, values(uri_path) as uri_paths, max(body_len) as max_body_bytes by clientip, host
| eval risk_reason="Oversized or deeply-nested SOAP/WSDL POST body — candidate cleanup_xml_node() stack-exhaustion trigger (CVE-2026-91765)"
| where request_count >= 1
| sort - max_body_bytesMicrosoft KQL
W3CIISLog
| where TimeGenerated > ago(24h)
| where csMethod == "POST"
| where csUriStem has_any ("soap", "wsdl", "?wsdl")
| where csBytes > 200000
| summarize RequestCount = count(), TotalBytes = sum(csBytes), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, csUriStem, sSiteName, csUserAgent
| where RequestCount >= 1
| project FirstSeen, LastSeen, cIP, csUriStem, sSiteName, RequestCount, TotalBytes, csUserAgent
| order by TotalBytes descSigma
title: Oversized SOAP POST Request Indicative of PHP SoapServer Recursion DoS
id: 7a3f1b2c-9e44-4d18-8a2f-1c5d6e7f9a01
status: experimental
description: Detects unusually large or deeply-nested XML POST requests to SOAP/WSDL endpoints consistent with the cleanup_xml_node() unbounded-recursion stack-exhaustion vulnerability in PHP's SOAP extension (CVE-2026-91765), which can crash an unauthenticated PHP-FPM/SoapServer worker.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-91765
- https://github.com/advisories/GHSA-rgrp-mwpx-f6rm
author: Threadlinqs Team
date: 2026-09-26
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1499.004
- attack.reconnaissance
- attack.t1595.002
- cve.2026.91765
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains:
- 'soap'
- 'wsdl'
- '?wsdl'
filter_size:
cs-bytes|gt: 200000
condition: selection and filter_size
falsepositives:
- Legitimate bulk SOAP integrations transferring large signed XML payloads (e.g. banking/EDI batch transactions)
level: highKnown false positives:
- Legitimate high-volume SOAP/WSDL integrations (banking batch files, EDI, large signed XML payloads) exceeding the size threshold
- Automated API-contract/WSDL crawlers used by internal integration testing tools
Tuning notes: Tune body_len / csBytes threshold to the site's legitimate max SOAP payload size (baseline over 30 days); correlate with php-fpm worker restart/crash events in the same window to raise confidence before alerting on size alone.
- [indicator] SoapServer Oversized/Nested XML POST — Unbounded Recursion DoS (CVE-2026-91765) · unlock with TL Creds
- PHP-FPM FastCGI IPv6 ACL /96 Bypass & Reserved Device-Name Path Abuse (CVE-2026-91768 / CVE-2026-17545) · unlock with TL Creds
- [indicator] Outbound TLS Verification Bypass & Cross-Origin Credential Header Leak on Redirect (CVE-2026-91767/91769/91766) · unlock with TL Creds
- [indicator] SoapServer Oversized/Nested XML POST — Unbounded Recursion DoS (CVE-2026-91765) · unlock with TL Creds
- [indicator] Process Invoked With Windows Reserved Device Name Path Argument (CVE-2026-17545) · unlock with TL Creds
- Authorization or Cookie Header Forwarded Cross-Origin Following HTTP Redirect (CVE-2026-91766) · unlock with TL Creds
- PHP-FPM FastCGI IPv6 ACL /96 Bypass & Reserved Device-Name Path Abuse (CVE-2026-91768 / CVE-2026-17545) · unlock with TL Creds
- [indicator] Outbound TLS Verification Bypass & Cross-Origin Credential Header Leak on Redirect (CVE-2026-91767/91769/91766) · unlock with TL Creds
Indicators of compromise
As of 2026-09-25, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-2658.
Technical analysis
No CVE is listed in the CISA KEV catalog and no public proof-of-concept exploit has been confirmed for any of them as of disclosure.
On 22-24 September 2026 the PHP Foundation shipped four coordinated security releases — PHP 8.2.34 and 8.3.35 (security-only) and PHP 8.4.26 and 8.5.11 (bug-fix + security) — closing out a set of 11 CVEs across six components. GovCERT.HK published Security Alert A26-09-40 on 25 September 2026 summarizing the bundle at its own 'Security Alert' (not 'High Threat Security Alert') tier, i.e. medium severity by their classification convention, with the stated cross-cutting impact framed as denial of service. NVD's per-CVE records, however, show the bundle also carries information-disclosure and authentication-bypass consequences beyond DoS.
The highest-severity issue, CVE-2026-91765 (CVSS 7.5), is an unbounded-recursion flaw in the SOAP extension: cleanup_xml_node() in the XML parser recurses once per nesting level with no depth limit, so an unauthenticated attacker can POST a SOAP request with tens of thousands of nested elements to any SoapServer endpoint, exhaust the call stack, and crash the worker process; the same unbounded-recursion pattern also exists in the SOAP value decoder and the WSDL node-search helper per the GHSA-rgrp-mwpx-f6rm write-up.
A second cluster affects OpenSSL/TLS client verification. CVE-2026-91767 is a heap buffer over-read in php_openssl_matches_wildcard_name() (ext/openssl/xp_ssl.c): a length argument passed to memchr() underflows when a malicious server presents a wildcard certificate name longer than the hostname being verified, letting the server force the client to read past a heap allocation. CVE-2026-91769 is a logic flaw where PHP's peer-verification code checks a certificate's subjectAltName entries and, when none match, incorrectly falls back to the Common Name — violating RFC 6125, which requires the CN to be ignored once any subjectAltName is present — so a certificate with a non-matching SAN but a matching CN is still accepted. Both are reachable by default because PHP enables peer-name verification automatically on outbound TLS client streams.
A third issue, CVE-2026-91768, is an access-control bypass in PHP-FPM: the IPv6 branch of the FastCGI client-address check compares only the first 12 of 16 address bytes, so listen.allowed_clients effectively matches on a /96 prefix rather than the full address, letting any attacker who can source a request from a matching /96 network reach an endpoint that was meant to be restricted.
A fourth cluster covers the Standard extension's HTTP stream wrapper: CVE-2026-91766 forwards Authorization, Cookie, and Proxy-Authorization headers unchanged when the wrapper follows a redirect, even across a different host, port, or an HTTPS-to-HTTP downgrade, allowing a malicious or compromised redirect target to capture credentials meant for the original origin; CVE-2026-93682 is a one-byte heap over-read when a redirect response carries an empty Location header, letting a malicious server influence where the read runs off into and where the client's dereferenced redirect target ends up; and CVE-2026-92842 is a heap-memory disclosure in the convert.base64-encode / convert.quoted-printable-encode / convert.quoted-printable-decode stream filters, where the constructor's line-break-chars option tracks length separately from the string and mishandles embedded NUL bytes, disclosing adjacent heap memory in filtered output.
Rounding out the set: CVE-2026-6103 is an integer overflow in Phar's phar_tar_number(), which parses an 11-digit octal TAR size field into an unchecked uint32_t so a size above 0xFFFFFFFF silently wraps, letting a crafted TAR archive smuggle entries that PharData extracts as if legitimate; CVE-2026-17545 is PHP's failure on Windows to reject reserved device names (CON, PRN, AUX, NUL, COM1-COM9, LPT1-LPT9, CONIN$, CONOUT$) as path components in filesystem/stream functions, so an attacker-supplied filename can open a character device and hang a worker thread; CVE-2025-14181 is a SOAP HTTP client integer-overflow-to-buffer-overflow, where a buffer-growth check relies on undefined-behavior signed-integer overflow that a compiler may optimize away, letting a malicious SOAP server make the client allocate an undersized buffer it then overflows; and CVE-2025-1218 is a set of packet over-reads in the mysqlnd wire-protocol parser, which reads fixed-width fields out of server packets before confirming enough bytes remain, so a malicious or compromised MySQL server can send a truncated packet and crash the client.
None of the 11 CVEs appear in the CISA Known Exploited Vulnerabilities catalog as of 25 September 2026, and third-party exploit trackers (TheHackerWire) report no confirmed public proof-of-concept for the two highest-severity issues (CVE-2026-91765, CVE-2026-91768) at disclosure. All 11 require either an attacker-controlled/compromised counterparty server (MySQL, SOAP, HTTP/TLS) or direct network reachability to a PHP-FPM/SOAP endpoint — none is exploitable purely client-side without such a position.
MITRE ATT&CK techniques by tactic:
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Impact
T1499.004 Application or System Exploitation
Resource Development
T1583.004 Server; T1588.006 Vulnerabilities
Reconnaissance
T1590.005 IP Addresses; T1592.002 Software; T1595.002 Vulnerability Scanning
Remediation
Patches
- PHP 8.5.11
- PHP 8.4.26
- PHP 8.3.35
- PHP 8.2.34
Immediate actions
- Upgrade all PHP installations to 8.5.11, 8.4.26, 8.3.35, or 8.2.34 (or later within the same branch) immediately
- Restart php-fpm, Apache mod_php, and any long-running PHP CLI worker processes after upgrading so the patched binary is actually loaded
- Audit PHP-FPM listen.allowed_clients ACL rules that rely on IPv6 prefixes; treat IPv6-based allowlisting as unreliable until patched (CVE-2026-91768)
- Review outbound HTTP client code (file_get_contents(), stream_context, SOAP/HTTP clients) for redirect-following behavior toward untrusted or third-party hosts (CVE-2026-91766, CVE-2026-93682)
Workarounds
- Where immediate upgrade is not possible, restrict PHP-FPM FastCGI listener exposure to trusted IPv4 ranges only and disable IPv6-based ACL entries (mitigates CVE-2026-91768)
- Firewall SOAP endpoints off from untrusted networks until patched (mitigates CVE-2026-91765)
- Strip or refuse to forward Authorization/Cookie/Proxy-Authorization headers in application code that manually follows HTTP redirects (mitigates CVE-2026-91766)
Longer-term hardening
- Restrict public exposure of SoapServer endpoints that do not need to be internet-facing to reduce the blast radius of CVE-2026-91765
- For high-value outbound TLS connections, do not rely solely on hostname/CN matching for peer verification; consider certificate pinning or explicit SAN allowlists
- Adopt automated PHP version/patch tracking (OS package security channels, Renovate/Dependabot equivalents) to shorten time-to-patch on future PHP security releases
- Validate user-supplied filenames on Windows PHP deployments against the reserved device name list (CON, PRN, AUX, NUL, COM1-9, LPT1-9, CONIN$, CONOUT$) before passing them to filesystem/stream functions
Affected and fixed versions
Timeline
- PHP 8.3.35, a security-only release, is published alongside 8.2.34 with the same 11 fixes.
- PHP 8.2.34, a security-only release, is published by the PHP Foundation, backporting fixes for all 11 vulnerabilities to the oldest actively supported branch.
- PHP 8.4.26 and PHP 8.5.11 are released, bundling the same 11 security fixes together with general bug fixes for DOM, generators, GD, Intl, and grapheme handling.
- Cross-reference against the CISA Known Exploited Vulnerabilities catalog (1,726 entries as of this date) finds none of the 11 PHP CVEs listed, indicating no confirmed active exploitation.
- Third-party exploit tracker TheHackerWire reports no confirmed public proof-of-concept exploit code for CVE-2026-91765 or CVE-2026-91768 as of initial disclosure.
- GovCERT.HK issues Security Alert A26-09-40, 'Multiple Vulnerabilities in PHP,' classifying the bundle at its standard 'Security Alert' tier (not 'High Threat Security Alert') and urging immediate patching.
- GitHub Security Advisories are published for each CVE (e.g. GHSA-rgrp-mwpx-f6rm for CVE-2026-91765, GHSA-62xp-839h-2637 for CVE-2026-91768, GHSA-xr7j-rvgx-xq5p for CVE-2026-91767) with root-cause technical write-ups.
- NVD publishes CVE records for the nine 2026-series vulnerabilities (CVE-2026-6103, -17545, -91765 through -91769, -92842, -93682) with CVSS v3.1 base scores ranging 4.3-7.5.
Sources cited
- Security Alert (A26-09-40): Multiple Vulnerabilities in PHP govcert.gov.hk · Advisory · 2026-09-25
- NVD - CVE-2026-91765 (SOAP unbounded recursion, CVSS 7.5) NVD (NIST) · Advisory · 2026-09-25
- NVD - CVE-2026-91768 (FPM IPv6 ACL bypass, CVSS 6.5) NVD (NIST) · Advisory · 2026-09-25
- NVD - CVE-2026-91766 (Cross-origin credential leak on redirect, CVSS 5.9) NVD (NIST) · Advisory · 2026-09-25
- PHP 8 ChangeLog (8.5.11 / 8.4.26 / 8.3.35 / 8.2.34) php.net · Vendor report · 2026-09-24
- PHP 8.4.26: Release Information, Changelog, and Download links php.watch · Vendor report · 2026-09-24
- PHP 8.2.34 Release Information php.watch · Vendor report · 2026-09-22
- PHP 8.2, 8.3, 8.4 and 8.5 updated to their latest security patch releases docs.pantheon.io · Vendor report · 2026-09-25
- CVE-2026-91765 PoC, Exploit Status & Vulnerability Details thehackerwire.com · Research · 2026-09-25
- CVE-2026-91768 PoC, Exploit Status & Vulnerability Details thehackerwire.com · Research · 2026-09-25
- CVE-2026-91767: PHP Vulnerability (CVSS 6.5) — Fix & Details strix.ai · Research · 2026-09-25
- GitHub Security Advisory GHSA-rgrp-mwpx-f6rm (CVE-2026-91765) GitHub · Code repository · 2026-09-25
- GitHub Security Advisory GHSA-62xp-839h-2637 (CVE-2026-91768) GitHub · Code repository · 2026-09-25
- GitHub Security Advisory GHSA-xr7j-rvgx-xq5p (CVE-2026-91767) GitHub · Code repository · 2026-09-25
- Critical PHP Vulnerabilities Patched in New Releases securityonline.info · News · 2026-09-25
Previous and next in vulnerability
Drafted by the Threadlinqs research pipeline from 15 sources; published ; last updated —.
